OPEN SOURCE. PEOPLE FIRST.

Privacy policy

OpenWebPBX Free Phone, our website and OpenWeb-operated services.

Updated 17 October 2026 · Open ISP cc

Open ISP cc, a South African close corporation, registration number 2005/156968/23, maintains the OpenWeb PBX project and publishes OpenWebPBX Free Phone. Our address is 22 Ladlau Drive, Simbithi Eco-Estate, Ballito, 4399, South Africa. We are responsible for personal information we decide how and why to use, including project enquiries and website administration.

Your organisation may operate its own PBX or use another provider. That organisation normally decides the purpose, access, call recording and retention of its PBX records and is its controller/responsible party. Providing open-source software does not give Open ISP cc access to independently hosted PBX records. Where we operate or support a PBX on an organisation's instructions, the parties must identify their respective roles and processing terms.

Information and its sources

• Website visits: hosting systems receive your IP address, request time, requested page, browser information and basic connection/security information. The site has no advertising or analytics trackers. Optional colour-theme storage stays in your browser; see cookies and local storage.
• Enquiries and privacy requests: we receive the contact information, message and relevant service references you give us by email or telephone. Your organisation's administrator may provide account or support information. We may ask for proportionate proof that you can act for the account. Do not send passwords, QR codes or unnecessary identity documents.
• Phone connection: the Android app stores the PBX address, extension, display/device name, device connection identifier and credentials needed to connect. Credentials are encrypted in private app storage with Android Keystore; Android app backup is disabled.
• Calls: microphone audio goes to your chosen PBX during calls, including background calls. The PBX routes audio and processes calling numbers, times, duration, direction and answered status. Its administrator may enable recordings and voicemail. Information can originate from you, your organisation, other callers, the device, PBX and telephone providers.
• Directory, voicemail and QR codes: the app retrieves its directory and voicemail from your PBX; it does not read or upload the Android address book. Voicemail is temporarily cached for playback and removed when playback stops or the view closes. QR frames are processed on the phone and not uploaded; the decoded setup code goes to the selected PBX. Manual code entry is available.
• Technical information: the PBX receives network addresses, authentication requests, app version, device name and operational events needed to operate or troubleshoot its service.

Purposes and lawful grounds

When GDPR applies to processing we control, the grounds below apply. Under POPIA, processing must also meet its applicable conditions, including necessity, purpose limitation and the relevant consent, contract, legal-duty or legitimate-interest justification. Accepting website storage does not authorise call recording or every use of personal information.

You do not have to allow optional storage, submit an enquiry or provide unnecessary information. Without essential account, connection and calling information, the app/PBX cannot connect your phone or deliver calls. Without sufficient details or identity verification we may be unable to complete a particular request; we will explain what is needed. The site does not subscribe visitors to marketing, sell personal information or use advertising identifiers.

Recipients and optional services

Relevant information is available to authorised staff, your PBX operator and its instructed hosting, support and telephone providers as necessary for their tasks. A lawful disclosure to an authority may be required. Independently operated services have their own privacy terms.

If your administrator enables incoming wake-up, Google Play Services delivers short-lived encrypted call alerts. The PBX stores the notification endpoint and encryption information. Google processes delivery/network information; an optional Cloudflare relay forwards encrypted alerts and may keep operational logs. This channel does not carry call audio, phone passwords, voicemail or recordings. The app checks the current call with your PBX before showing an alert. Android force-stop prevents wake-up until the app is reopened.

The app uses Linphone SDK for calling and ZXing for QR decoding. Release checks and direct downloads contact GitHub; the Play edition uses Google Play for store installation. These services receive ordinary network requests under their own policies. Clicking an external link is your choice; the public website does not embed their advertising or analytics scripts.

International processing

The project is operated in South Africa. Depending on your PBX location and providers, information may be processed outside South Africa or the European Economic Area. Cross-border processing must meet applicable GDPR and POPIA conditions; these can require an adequacy decision, appropriate contractual safeguards and a transfer assessment, or another lawful exception. Ask the Information Officer for destinations, recipients and safeguards applicable to an OpenWeb-operated service, or your administrator for an independently hosted service. A provider's name alone does not establish the applicable transfer mechanism.

Retention and deletion

• Browser choices: privacy choices are valid for 180 days. Optional appearance storage expires with that choice. Expired local-storage values are removed when the site next checks them; browser controls can clear them earlier.
• Phone data: connection information is held while the device is connected. Settings → Disconnect this phone revokes access and removes local connection details and pending history after the PBX confirms removal. Uninstalling/clearing Android storage removes local app data, but does not delete the PBX account or server records.
• Website logs and correspondence: retention depends on the need to operate/protect the service, resolve the request or incident, meet an applicable record-keeping duty and handle a genuine legal claim. Information must be deleted or anonymised when those purposes and any lawful preservation requirement end. You can ask the Information Officer for the applicable period and justification for a particular record.
• PBX records: the responsible operator sets retention for call records, voicemail, recordings, logs and backups, taking account of the service purpose and legal duties. It must explain the period or criteria, backup expiry and how deletions are respected after restoration. Open ISP cc cannot directly erase an independent server.

See account and data deletion. Where a request cannot be completed in full, the responsible operator must explain what is retained, the reason and applicable period; withdrawing consent does not undo processing that was lawful before withdrawal.

Your privacy rights

Subject to applicable conditions and exemptions, you may request access, correction or deletion; object to processing; and withdraw consent for consent-based uses. GDPR also provides rights to restriction and data portability in applicable cases. You may object to legitimate-interest processing on grounds relating to your situation, and to direct marketing at any time. POPIA permits you to ask whether we hold your personal information and to challenge unlawful, inaccurate, excessive or outdated processing.

Use Privacy requests or contact Leon Whitherall. GDPR requests are handled without undue delay and normally within one month; a permitted extension of up to two further months must be explained within the first month. POPIA/PAIA requests follow their applicable procedure; formal PAIA access decisions are generally due within 30 days, with only a permitted, notified extension. We explain any lawful refusal and available complaint route. GDPR rights requests are normally free; only lawful exceptions or prescribed access-copy fees may apply, with an explanation before charging.

Children, automated decisions and security

The service is intended for organisational calling. Processing a child's information requires the applicable lawful authority; contact the Information Officer if a child's information has been supplied inappropriately. The public website and phone app do not make decisions intended to produce legal or similarly significant effects solely through automated profiling. Your administrator configures ordinary calling rules.

Phone setup/account requests use HTTPS; app-to-PBX signalling uses TLS and audio uses SRTP. These protect that connection, rather than guaranteeing encryption through every telephone provider. Access controls and other safeguards depend on the service and operator. The website does not ask for phone passwords or recordings in public requests. Suspected security compromises can be reported to the Information Officer; required regulator and affected-person notifications follow the applicable law.

Complaints

You can contact the Information Officer, and you do not have to finish our process before contacting a competent regulator. For South Africa, contact the Information Regulator; its POPIA forms include objections, correction/deletion and complaints. For GDPR, you may complain to a competent authority, including where you live, work or where the alleged infringement occurred; the EDPB authority directory lists contacts.

This notice covers the public website, app and processing within our responsibility. Your PBX operator must give its own deployment-specific notice where required. Updates will be published here with a revised date.